No more IP addresses and certificate warnings on the home network

Typing an IP address and a port number, then clicking past a scary certificate warning, is fun exactly once. I wanted every internal service on a proper name with a real, valid certificate, and I didn't want to expose a single one of them to the internet to get it.

The recipe

1. A subdomain just for the LAN, something like *.lan.example.com, that only resolves inside the house.
2. A wildcard certificate from Let's Encrypt using the DNS-01 challenge. The reverse proxy proves it owns the domain by creating a TXT record through the DNS provider's API, which means no port has to be open to the internet. This is the trick that makes the whole thing work.
3. A local DNS server (your ad-blocking resolver is perfect for this) that answers *.lan.example.com with the proxy's address.
4. A reverse proxy that maps each name to a service. Mine reads a plain text file of name  upstream  flags and generates its whole config from it. Adding a service is one line.

Details that save you a weekend

• Give the LAN proxy its own IP address. The server already had another proxy on ports 80 and 443 for public traffic. Putting the LAN proxy on a second address means they never fight over ports.
• Scope the API token to DNS edits only. If it leaks, editing DNS records is all it can do.
• Redirect, don't duplicate. When a service also has a public name, its LAN name just redirects there, so bookmarks and login cookies all live on one hostname.
• VPN clients need to use the home DNS server too, or none of the LAN names resolve once you leave the house.

The payoff: every service has a short name you can actually remember, a padlock in the address bar, and not a single new open port.